CVE-2025-43864
React Router allows a DoS via cache poisoning by forcing SPA mode
En bref
- Sévérité
- HIGH 7.5
- EPSS
- EPSS 20.47 % · centile 97 (2026-10-27)
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Deferred
Description
React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
Faiblesses (CWE)
Avis
- GHSA-f46r-rw29-r322 — React Router allows a DoS via cache poisoning by forcing SPA mode
Références européennes
- ENISA EUVD · EUVD-2025-11980
- GCVE · GCVE-0-2025-43864
Avis du CERT-FR
- CERTFR-2026-AVI-0054 — Multiples vulnérabilités dans Centreon Infra Monitoring · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1127 — Multiples vulnérabilités dans Centreon Web · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| remix-run · react-router | affected >= 7.2.0, < 7.5.2 |
Références
- https://github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322
- https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111
- https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |